Cisco Router Securing Administrative Access

Disable DNS lookup

R1(config)#ip domain-name jpudasaini.com.np

Set a minimum password length of 10 characters
R1(config)#security password min-length 10

Configure the enable secret password
R1(config)#enable secret cisco11111

Console password and enable login
R1(config)#line console 0
R1(config-line)#password ciscocon111111

Line to log out after 5 minutes of inactivity
R1(config-line)#exec-timeout 5 0
R1(config-line)#login

Prevents console messages from interrutpin command entry
R1(config-line)#logging synchronous

secure AUX port for router
R1(config)#line aux 0
R1(config-line)#password ciscoauxpass
R1(config-line)#exec-timeout 5 0
R1(config-line)#login

Password on the vty lines for router
R1(config)#line vty 0 4
R1(config-line)#password ciscovtypass
R1(config-line)#exec-timeout 5 0
R1(config-line)#login

command to encrypt the console, aux and vty password
R1(config)# service password-encryption
Login warning banner on router
R1(config)#banner motd $Unauthorized access strictly prohibited and
prosecuted to the full extent of the law$
R1(config)#exit

Define local login accounts
R1(config)#line console 0
R1(config-line)#login local
R1(config-line)#end
R1#exit

Define locally login accounts
R1(config)#line aux 0
R1(config-line)#login local

Watch for login attacks
Current router login attacks
R1#show login

This command indicate a 60 second login shutdown if two failed login attempts are made within 30 seconds.
R1(config)#login block-for 60 attempts 2 within 30
R1#show login

Log login activity
R1(config)#login on-success log
R1(config)#login on-failure log every 2
R1(config)#exit

Set privilege level of 15 so user with that highest privilege will default to it.

R1(config)#line vty 0 4
R1(config-line)#privilege level 15
R1(config-line)#login local
R1(config-line)#transport input ssh
R1(config-line)#exit

Configure RSA keys with 1024 for the number of mudulus bits.
R1(config)#crypto key generate rsa general-keys modulus 1024
R1(config)#exit

show ip ssh
R1#show ip ssh

ssh time out
R1(config)#ip ssh time-out 90
R1(config)#ip ssh authentication-retries 3
R1(config)#do wr